CVE-2026-97844: DNS Server Information Disclosure Vulnerability

CVE-2026-97844 Overview

CVE-2026-97844 is an out-of-bounds read vulnerability [CWE-125] in Microsoft DNS Server. An authorized attacker can exploit the flaw over a network to disclose sensitive information from the DNS Server process memory. The vulnerability requires low privileges and no user interaction, making it exploitable in environments where attackers hold limited DNS-related permissions.

Microsoft published the advisory on October 13, 2026. The flaw does not affect integrity or availability, but memory disclosure can expose internal state useful for chained attacks against directory and name resolution infrastructure.

Critical Impact
Authorized network attackers can read out-of-bounds memory from the DNS Server process, potentially disclosing sensitive runtime data such as cached records, pointers, or configuration fragments.

Affected Products

Microsoft DNS Server (see the Microsoft CVE-2026-97844 Advisory for the full product list)
Windows Server roles running the DNS Server service
Environments exposing authenticated DNS management or query interfaces

Discovery Timeline

2026-10-13 - CVE CVE-2026-97844 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97844

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the Microsoft DNS Server component. The service reads memory past the end of an allocated buffer when processing attacker-controlled input over the network. The resulting disclosure can expose adjacent heap or stack contents from the DNS Server process.

Exploitation requires an authenticated session with low-level privileges. No user interaction is needed, and the attack scope remains unchanged. Only confidentiality is impacted; the attacker cannot modify DNS records or crash the service through this flaw alone.

DNS Server runs with elevated privileges in Windows Server deployments. Information leaked from the process can include DNS zone data, internal network identifiers, memory addresses that defeat Address Space Layout Randomization (ASLR), or fragments of authentication material cached in memory. These disclosures are frequently combined with other vulnerabilities to build reliable exploit chains against Active Directory environments.

Root Cause

The root cause is improper validation of a length or index value during parsing of a DNS protocol structure. When the server computes a read offset based on untrusted field values, it accesses bytes beyond the allocated buffer boundary. The returned data is then included in a response or error path reachable by the authenticated attacker.

Attack Vector

The attack vector is network-based. An attacker with low privileges sends a crafted request to the DNS Server over an authenticated channel. The server processes the malformed input, performs the out-of-bounds read, and returns memory contents to the attacker. Repeated requests can incrementally map process memory for further exploitation.

No verified public proof-of-concept code is available at the time of writing. Refer to the Microsoft CVE-2026-97844 Advisory for technical specifics as Microsoft releases them.

Detection Methods for CVE-2026-97844

Indicators of Compromise

Unusual authenticated DNS management traffic from accounts that do not normally interact with DNS Server
Repeated malformed DNS requests targeting the same server from a single authenticated source
Elevated error or debug events generated by the DNS Server service correlating with specific client sessions

Detection Strategies

Monitor Windows Event Logs for DNS Server service errors, crashes, or anomalous warnings during request parsing
Baseline normal DNS management traffic patterns and alert on authenticated outliers
Correlate DNS Server anomalies with authentication events from low-privilege accounts to surface credential misuse

Monitoring Recommendations

Capture DNS Server network traffic for forensic review when anomalies are detected
Enable detailed auditing on accounts with DNS Server access rights
Forward DNS Server telemetry to a centralized SIEM or data lake for cross-source correlation and retention

How to Mitigate CVE-2026-97844

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-97844 Advisory as soon as it is released for your Windows Server version
Inventory all Windows Servers running the DNS Server role and prioritize internet-adjacent or multi-tenant hosts
Audit accounts holding DNS management privileges and remove unnecessary assignments

Patch Information

Microsoft maintains the authoritative patch guidance in the Microsoft CVE-2026-97844 Advisory. Install the applicable cumulative update for each affected Windows Server release and restart the DNS Server service to activate the fix.

Workarounds

Restrict network access to the DNS Server management interface using host-based firewall rules and network segmentation
Enforce least privilege on DNS-related security groups and remove dormant delegations
Monitor DNS Server process memory and crash telemetry until patching is complete

bash

# Configuration example: list hosts running the DNS Server role for patch tracking
Get-WindowsFeature -Name DNS | Where-Object { $_.InstallState -eq 'Installed' }

# Restrict DNS management RPC to specific administrative subnets
New-NetFirewallRule -DisplayName "Restrict DNS Mgmt" -Direction Inbound \
  -Protocol TCP -LocalPort 53 -RemoteAddress 10.10.0.0/24 -Action Allow